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Lin et al. [S. Lin, F. Gao, Q.-y. Wen, F.-c. Zhu, Opt. Commun. 281 (2008) 4553] pointed that 
the muhiparty quantum secret sharing protocol [Z.-j. Zhang, G. Gao, X. Wang, L.-f. Han, S.-h. Shi, 
_ Opt. Commun. 269 (2007) 418] is insecure and proposed an improved three-party quantum secret 

. sharing protocol. In this paper, we study the security of the improved three-party quantum secret 



sharing protocol and find that it is still insecure. Finally, a further improved three-party quantum 
secret sharing protocol is proposed. 
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I. INTRODUCTION 

In the last decade, as the principles of quantum mechanics are introduced, a lot of interesting applications 
are realized in the field of cryptography. Quantum secret sharing (QSS) [1-25] is one of these applications, 
which allows that a secret message is spitted into several pieces by a boss, and each agent owns a piece, 
and no subset of agents can be sufficient to extract the boss's secret message, but the whole set can. The 
first QSS protocol in which a three-particle entangled Greenberger-Home-Zeilinger (GHZ) state was used 
is proposed by Hillery et al. [1]. Although this protocol has elegantly shown the essence of QSS, it is hard 
to realize experimentally because of the inefficiency as regards the generation of a three-particle entangled 
^ . state. Recently, in order to increase the practical feasibility, Zhang et al. [15] utilized Einstein-Podolsky- 

I Rosen (EPR) pairs and the five local operations to propose a novel QSS protocol. However, it is a slight 

pity that this protocol has a drawback of security, which was pointed out by Lin et al. [16]. Lin et al. 
showed that the last agent may solely obtain half of Alice's secret messages without the other agents' helps, 
moreover, they gave an improvement of Zhang et al. QSS protocol. Later on, Wang et al. [17] claimed that 
the three-party case in Lin et al. improved protocol [16] is secure, and pointed out that the n-party (n > 4) 
case is insecure, and they show that the first agent and the last agent in the improved QSS protocol [16] 
may collaborate to eavesdrop Alice's secret messages without introducing any error. Obviously, both Lin et 
al. attack and Wang et al. attack are from the inside dishonest agents in QSS, and the attack power of the 
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dishonest agent is very strong because he (she) has a chance to tell a lie during the checking security. Only 
if the he is successfully constructed, he (she) can eavesdrop the secret messages without being detected by 
the other participants. Therefore, we should mainly focus on the dishonest agent's attack while analyzing 
the security of the QSS protocol. 

In this paper, we study the security of the three-party case of Lin et al. improved QSS protocol [16] and 
find that it is also insecure. Before describing our attack strategy, first, let us review Lin et al. improved 
three-party protocol [16] as follows: (l)Bob prepares photons h and t in one of four Bell states: il)^^ = 
(|0)|1) ± |l)|0))ftt/V2, (t)ht = (|0)|0) ± |l)|l))/it/V2. Then he sends photon t to Charlie and retains 
photon /i in his site. (2)After receiving photon t, firstly, Charlie ascertains whether photon t is a single 
photon [18]. If not, the communication will be terminated. Otherwise, he performs one of the five local 
operations: I, Gx, cFy, (Tz, H on photon t. The probabilities that the five operations are selected by her are 
1/8, 1/8, 1/8, 1/8 and 1/2, respectively. Here, / = |0)(0| + |1)(1|, = |0)(0| - |1)(1|, cry = |0)(1| - |1)(0|, 

= |0)(1| + |1)(0|, F = (|0)(0|-|l)(l| + |0)(l| + |l)(0|)/\/2. Then he sends photon t to Alice. (3)After 
receiving photon t, Alice randomly switches between the control mode and the message mode. In the control 
mode, Ahce randomly selects one action from the two choices: One is that she lets Bob use {|0), or 
{\h) = (|0) + |l))/\/2, \v) = ( 1 0) — 1 1))/\/2} to measure photon /i, and tell her his measurement outcome 
and initial Bell state. Then Ahce requires Charhe to announce their operations. The other is that Alice first 
lets Charhe announce their operations, and then asks Bob to perform a measurement on photon h and tell 
her his measurement outcome and initial Bell state. Next, Alice uses correct measuring basis to measure 
the t photon. By comparing her measurement outcome with the deduced outcome, Alice can judge whether 
quantum channel is secure. If the quantum channel is attacked, the communication is aborted. Otherwise, 
the transmission goes on to Step (1). In the message mode, Alice performs a unitary operation (/, ax, (Jy, 
az) on photon t to encode her secret messages. After her encoding, Ahce sends all the t-photons of message 
mode as a sequence (i-sequence) to Bob in one communication. Before sending f-sequence, Alice prepares 
a certain number of single photons (checking photons) randomly in one of four states: |0), \h), \v), 
and inserts these checking photons into t-sequence. And then, she sends t-sequence to Bob. (4)After Bob 
receives the sequence, Alice tells Bob the positions of checking photons in the t-sequence and the initial 
states of all checking photons. Bob picks out the checking photons and uses the suitable basis to measure 
them. And then, by comparing his measurement outcomes with the initial states, Bob can judges whether 
quantum channel between Alice and him is secure. After confirming that no eavesdropping exists, they can 
extract Alice's secret messages if Bob and Charlie collaborate. (5)At last, Alice announces a small part of 
the secret messages so that Bob and Charhe can execute the message authentication process. 
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n. SECURITY LEAK OF LEV ET AL. IMPROVED THREE-PARTY QSS PROTOCOL 

We can see that, in Lin et al . improved three-party protocol [16], Alice inserts the checking photons 
into the t-sequence in order to prevent CharUe from eavesdropping. By making a single-photon measure- 
ment on each checking photon, Alice may judge whether the quantum channel between Alice and Bob is 
safe. Though the process of the security-check is added, their improved three-party quantum secret sharing 
protocol is still insecure. In what follows, we will detailedly analyse why it isn't secure. 

In advance, Bob prepares two EPR photon pairs. Suppose that one pair is in and the other c/)^^. 
According to Step (1), Bob sends photon t to Charlie. After receiving photon t, Charlie performs one of the 
five local operations: I, ax, CFy, Oz, H on it, and then sends photon t to Alice. When photon t is traveling 
between Charhe and Alice, Bob intercepts it, and stores it well. At the same time. Bob sends photon h (that 
is from "^ab)' instead of photon t, to Alice. Alice randomly switches the control mode and the message 
mode. In the control mode, when Alice requires Bob to make single-photon measurement on photon h, 
firstly. Bob immediately makes Bell state measurement on photons a and h. Obviously, this is the entangle 
swapping process of Bell states. Suppose that the operation performed by Charlie is H, the whole system 
state can be written as follows: 

Suppose that Bob's Bell state measurement outcome on photons a and h is According to Equation 
(1), photons b and t must be in ((^^ + V'bt)- Next, Bob makes a comparison for ijj'^f^ and ijj~f^, and gets the 
unitary operation cr^. This kind of Bell state comparison method and its comparison steps can be consulted 
in the paper [26]. By the way, here the four operations /, ax, ay, a^ are similar to the four operators Ui, 
U2, U^, U4 in the paper [26]. After making Bell state measurement, Bob uses {|0), |1)} or \v)} to 
measure photon t and tells Alice his single-qubit measurement outcome. According to Step (3), Bob still 
needs to tell Ahce his initial Bell state. In order that his replacing trick is not detected by Alice, Bob may 
not directly say that the initial Bell state is but should tell the he that it is cr^^^^ = (cr^ is just the 
gotten operator that Bob makes the Bell state comparison). So his replacing action will not be detected by 
Ahce. Here, we can't help asking why Bob's replacing action isn't detected? Continuing to analyse, the 
key of the question will be obtained. We know, that Alice deduces which state her and Bob's hand photons 
are in depends on the information published by Bob and Charlie. Only if it is satisfied that Alice's deducing 
state and the ((/)^ + i/j^^) are the same states, Bob's replacing trick can not be detected by Alice. From 
the above content, we can see that the initial state published by Bob is and the operation published by 
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Charlie is H, so Alice can only deduce as follows: 

<t>'ht^H<t>l^ = ct>l, + ^J^^ (2) 

Indeed, the ((/)^^ + ijjj^^) and the ((/)^ + ^j^) are the same states. Hence, Bob's replacing trick does not 
introduce any error. As for the other Bell states that Bob's measurement outcomes on photons a and h are, 
the law exists as of old. Here, for saving space of a whole page, we don't hst out the others' deducing 
processes again. So Bob may evade Alice's security-check successfully in the case that Charlie's operation 
is H. If Charlie's operation is one of four unitary operations: /, Gx, cry, Gz, is Bob's replacing trick also 
feasible? The answer is "yes". Suppose that the two Bell states prepared by Bob are still and 0^^, and 
the operation performed by Charlie is /. So the whole system state may be written as follows: 

Assume that Bob's measurement outcome on photons a and h is According to Equation (3), photons b 
and t must be in Similarly, Bob gets the unitary operation by comparing with ip~^^ [26]. So, he 
may tell the lie that it is cFxfkXt ~ '^ht when Alice requires him to publish the initial Bell state. According 
to Bob's and Charlie's I, Alice deduces that /V/tt ~ '^hf evident that the V'/j^j and the V'^^ are the 
same states. So Bob is also able to do his replacing trick in the case that Charlie's operation is one of four 
unitary operations. In a word, no matter what Charlie's operation is, Bob's replacing trick is not detected 
by Alice in the control mode. When the message mode is switched into, since Alice doesn't know that Bob 
has done the replacing trick and regards photon h as photon t as of old, she encodes her secret messages by 
performing a unitary operation on photon b. Then she sends photon b back to Bob. Bob very easily gets 
AUce's secret messages by making Bell state measurement on photons a and b without Charlie's helps. 

So far, we have successfully proposed a attack for Lin etal . improved three-party secret sharing protocol 
[16]. Meanwhile, we have also proved Wang etal. statement that the three-party case of Lin etal . improved 
protocol is secure is not correct. Obviously, that our attack and Wang et al. attack [17] are put together 
shows that Lin et al . improved QSS protocol [16] is completely insecure. Next, let us discuss how to 
further modify Lin et al . improved three-party QSS protocol so that it can resist this kind of attack. For the 
integrity, we describe the modified Lin et al . improved three-party protocol as follows in brief. 

(1') Bob prepares a batch of EPR photon pairs, which each pair is randomly in one of four Bell states. 
He takes out photon t from each EPR pair to form one sequence, called t sequence. The partner photon h 
in one EPR pair forms another sequence, called h sequence. Then Bob sends the t sequence to Charlie. 

(2') After receiving the t sequence, firstly, Charfie ascertains whether the photons in t sequence are a 
single photon [18]. If the multi-photon signal is detected, the communication will be terminated. Otherwise, 
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he performs one of the five local operations: /, ax, cry, Uz and H on each photon in the t sequence. The 
probabiUties that the five operations are selected by him are 1/8, 1/8, 1/8, 1/8 and 1/2, respectively. Next, 
Charlie prepares a certain number of decoy photons, which each decoy photon is randomly in one of four 
states: |0), Iv). He inserts these decoy photons into the t sequence, and then sends the t sequence 

to Alice. 

(3') After confirming that Alice receives the t sequence, Charlie tells Alice the position of each decoy 
photon in the t sequence and the state of each decoy photon. Afterwards, Alice uses the appropriate mea- 
suring basis to measure each decoy photon. So she can judge whether the quantum channel between hers 
and Charlie is secure. Next, what Ahce still needs to do is the same as that in Step (3). 

Steps (4'), (5') are same to Steps (4), (5) in Lin et al . improved three-party QSS protocol. 

Up to now, we have proposed a further improved three-party QSS protocol (Note that we only give 
the further improved three-party QSS case here). In contrast to Lin et al . improved protocol [16], our 
further improved protocol only adds one security-check process between Charlie and Alice. By the way, 
this process is also realized by utilizing some photons randomly in four states: |0), \h), \v). If Bob 
uses the above replacing trick to attack this further improved protocol, his eavesdropping action will fail 
because this process exists. The reason is that, firstly. Bob doesn't know the positions of decoy photons in 
t sequence and the states of decoy photons, secondly, both the decoy photon and the photon tint sequence 
are in maximally mixed state p = ^(|0)(0| -I- |1)(1|) for Bob so that he can't distinguish them, when he 
replaces the t sequence with another sequence prepared by him. Bob inevitably introduces some errors to 
the decoy photons. As a result, his replacing trick will be detected. In other words, our further improved 
three-party QSS protocol can stand against the above proposed attack. 

In the end, we discuss the securities of channels in this further improved three-party QSS protocol one 
by one. From Steps (2') and (3'), we see that the checking photons are used to assure the security of the 
channel between Ahce and Bob, and the decoy photons the security of the channel between Charhe and 
Alice. Moreover, the decoy photons and the checking photons are same and the purposes using them are 
also same, that is, to analyse whether the eavesdropping exists. As a matter of fact, the procedures that 
utilize decoy photons and checking photons to check eavesdropping are equivalent to the security checking 
in BB84 protocol [27]. Since BB84 protocol has been proved to be unconditionally secure [28,29,30], both 
of the Alice-Bob channel and the Charlie- Alice channel are also safe in this further improved protocol. Now, 
there leaves only the Bob-Charlie channel whose security is not discussed. If we regard Bob as one party, 
and regard two of Charhe and Alice as the other party, the security checking procedure for the Bob-Charlie 
channel is essentially the same as that in BBM92 protocol [31]. Similarly, since BBM92 protocol has been 
proved to be secure [32,33], his eavesdropping would be detected if the outside eavesdropper attacks the 
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Bob-Charlie channel. On the basis of these analysis, this further improved three-party QSS protocol is 
secure. 

m. SUMMARY 

We have shown that, by doing the replacing trick. Bob is able to solely eavesdrop Ahce's secret messages 
without introducing any error in Lin et al . improved three-party QSS protocol. That is, an efficient attack 
has been proposed for Lin et al. improved three-party QSS protocol by us. Obviously, the trait of this 
attack is that the Bell state comparison and the entanglement swapping are employed. By the way, the Bell 
state comparison [26] has been also used in the proposed attack strategy [25]. In addition, after giving this 
attack, we further modify Lin et al . improved three-party protocol so that it can stand against this attack. 
Finally, by means of analyzing each channel, we discuss the security of this further improved three-party 
QSS protocol. 

Note added— Recently, we detect that the proposed attack in this paper has a small drawback. The 

drawback mainly focuses on that the correlation of the two particles in one Bell state are not al- 
ways identical after the local operation H is performed on one of the two particles. For example, 
= (|0)|-) + \l)\+))bt/\/^ = - |l)|-))t6/V2. This means the proposed attack needs to be 

further optimized. 
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